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CLAIMS 

What is claimed is: 

1 . A method for investigating messages passed in a message-passing environment, 
comprising: 

collecting a plurality of messages from at least one participant in the message- 
passing environment; 

assembling the messages into at least one message sequence; 

analyzing said at least one message sequence to extract information regarding the 
message-passing environment; and 

outputting the information. 

2. The method according to claim 1, wherein the message-passing environment is 
a network environment including plural participants coupled together via a network. 

3. The method according to claim 2, wherein the network uses an Internet 
Protocol to transmit messages between participants. 

4. The method according to claim 2, wherein the messages express the 
information in one of a plurality of message formats. 

5. The method according to claim 2, wherein the messages include information 
expressed in a markup language. 

6. The method according to claim 5 5 wherein the markup language is the 
extensible markup language (XML). 
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7. The method according to claim 2, wherein the network uses Simple Object 
Access Protocol (SOAP) to transmit messages between participants. 

8. The method according to claim 1, wherein the message-passing environment is 
a machine or system including plural interacting components that function as message 
participants. 

9. The method according to claim 1, wherein the message-passing environment is 
a software program including plural interacting software modules that function as 
message participants. 

10. The method according to claim 1, further comprising, after the collecting, 
converting identifying information pertaining to said at least one participant into an 
indication of a role played by the participant in the message-passing environment. 

11. The method according to claim 1, wherein the assembling comprises 
combining multiple message traces into said at least one message sequence, each 
message trace pertaining to one or more messages transmitted by and/or received at a 
participant. 

12. The method according to claim 1, wherein the assembling comprises 
assembling plural message sequences, and the analyzing comprises analyzing the plural 
message sequences. 
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13. The method according to claim 1, wherein the analyzing involves performing 
cluster analysis to group said at least one message sequence into at least one cluster. 

14. The method according to claim 13, wherein the cluster analysis comprises: 
forming a data matrix based on information in said at least one message sequence; 

and 

forming said at least one cluster based on the data matrix. 

15. The method according to claim 14, wherein the forming of the data matrix 
involves extracting features from said at least one message sequence. 

16. The method according to claim 14, wherein the forming of the data matrix 
involves forming a similarity measure which measures the difference between said at 
least one message sequence and another message sequence. 

17. The method according to claim 13, wherein the analyzing involves identifying 
results of the cluster analysis that may warrant further investigation. 

18. The method according to claim 1, wherein the analyzing comprises comparing 
said at least one message sequence with a reference message sequence. 

19. A computer readable medium including machine readable instructions for 
implementing the collecting, assembling, analyzing, and outputting recited in claim 1. 
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20. An apparatus for investigating messages passed in a message-passing 
environment, comprising: 

message aggregation logic configured to collect a plurality of messages from at 
least one participant in the message-passing environment, and to assemble the messages 
into at least one message sequence; 

analysis logic configured to analyze said at least one message sequence to extract 
information regarding the message-passing environment; and 

output logic configured to output the information. 

21. The apparatus according to claim 20, wherein the message-passing 
environment is a network environment including plural participants coupled together via 
a network. 

22. The apparatus according to claim 21, wherein the network uses an Internet 
Protocol to transmit messages between participants. 

23. The apparatus according to claim 21, wherein the messages express the 
information in one of a plurality of message formats. 

24. The apparatus according to claim 21, wherein the messages include 
information expressed in a markup language. 

25. The method according to claim 25, wherein the markup language is the 
extensible markup language (XML). 
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26. The apparatus according to claim 21, wherein the network uses Simple Object 
Access Protocol (SOAP) to transmit messages between participants. 

27. The apparatus according to claim 20, wherein the message-passing 
environment is a machine or system including plural interacting components that function 
as message participants. 

28. The apparatus according to claim 20, wherein the message-passing 
environment is a software program including plural interacting software modules that 
function as message participants. 

29. The apparatus according to claim 20, wherein the message aggregation logic 
is further configured to convert identifying information pertaining to said at least one 
participant into an indication of a role played by the participant in the message-passing 
environment. 

30. The apparatus according to claim 20, wherein the message aggregation logic 
is further configured to combine multiple message traces into said at least one message 
sequence, each message trace pertaining to one or more messages transmitted by and/or 
received at a participant. 

3 1 . The apparatus according to claim 20, wherein the message aggregation logic 
is further configured to assemble plural message sequences, and the analysis logic is 
further configured to analyze the plural message sequences. 
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32. The apparatus according to claim 20, wherein the analysis logic is configured 
to perform cluster analysis to group said at least one message sequence into at least one 
cluster. 

33. The apparatus according to claim 32, wherein, in performing the cluster 
analysis, the analysis logic is further configured to: 

form a data matrix based on information in said at least one message sequence; 

and 

form said at least one cluster based on the data matrix. 

34. The apparatus according to claim 33, wherein the analysis logic is configured 
to form the data matrix by extracting features from said at least one message sequence. 

35. The apparatus according to claim 33, wherein the analysis logic is configured 
to form the data matrix by forming a similarity measure which measures the difference 
between said at least one message sequence and another message sequence. 

36. The apparatus according to claim 32, wherein the analysis logic is further 
configured to identify results of the cluster analysis that may warrant further 
investigation. 

37. The apparatus according to claim 20, wherein the analysis logic is further 
configured to compare said at least one message sequence with a reference message 
sequence. 
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38. A computer readable medium including machine readable instructions for 
implementing the message aggregation logic, the analysis logic, and the output logic of 
claim 20. 

39. An apparatus for investigating messages passed in a message-passing 
environment, comprising: 

means for collecting a plurality of messages from at least one participant in the 
message-passing environment; 

means for assembling the messages into at least one message sequence; 

means for analyzing said at least one message sequence to extract information 
regarding the message-passing environment; and 

means for outputting the information. 
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